Detection rules › Sublime MQL
Link: Multistage Landing - Abused Buildin.ai
Analyzes shared content links from buildin.ai domain that contain credential harvesting language with medium to high confidence in the display text.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Free file host, Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| type |
Rule body MQL
type.inbound
// filter to just buildin.ai
and any(filter(body.links,
(
.href_url.domain.root_domain == "buildin.ai"
and strings.icontains(.href_url.path, '/share')
// inspect display text
)
),
any(ml.nlu_classifier(ml.link_analysis(., mode="aggressive").final_dom.display_text
).intents,
.name == "cred_theft" and .confidence in ("medium", "high")
)
)
Detection logic
Scope: inbound message.
Analyzes shared content links from buildin.ai domain that contain credential harvesting language with medium to high confidence in the display text.
- inbound message
any of
filter(body.links)where:any of
ml.nlu_classifier(ml.link_analysis(., mode='aggressive').final_dom.display_text).intentswhere all hold:- .name is 'cred_theft'
- .confidence in ('medium', 'high')
Inspects: body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.path, type.inbound. Sensors: ml.link_analysis, ml.nlu_classifier, strings.icontains.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.root_domain | equals | buildin.ai |
strings.icontains | substring | /share |
ml.nlu_classifier(ml.link_analysis(filter(body.links)[], mode='aggressive').final_dom.display_text).intents[].name | equals | cred_theft |
ml.nlu_classifier(ml.link_analysis(filter(body.links)[], mode='aggressive').final_dom.display_text).intents[].confidence | member | medium |
ml.nlu_classifier(ml.link_analysis(filter(body.links)[], mode='aggressive').final_dom.display_text).intents[].confidence | member | high |